The third edition of Advanced Apple Debugging and Reverse Engineering brings everything up to the iOS 12 and Xcode 10 level, and it adds new chapters and new secrets to discover.

Because this book is so low-level, it’s no surprise that recent updates to Apple’s ecosystem meant that we had to rewrite a number of chapters. But hey, that’s what makes debugging and reverse engineering so much fun: always staying one step ahead!

Besides updating everything, we’ve also added four new chapters, wherein you’ll discover such things as adding watchpoints, how to use Mach-O functions, and how to pick apart a signed application and re-sign it yourself. I kid you not.

No goats were harmed in the making of this book, although Ray may have gotten a bit banged-up.

What’s in the Rest of the Book?

Here’s the complete listing of what’s contained in the book:

Section I: Beginning LLDB Commands

Getting Started: In this chapter, you’re going to get acquainted with LLDB and investigate the process of introspecting and debugging a program. You’ll start off by introspecting a program you didn’t even write — Xcode!

Help & Apropos: Just like any respectable developer tool, LLDB ships with a healthy amount of documentation. Knowing how to navigate through this documentation — including some of the more obscure command flags — is essential to mastering LLDB.

Attaching with LLDB: Now that you’ve learned about the two most essential commands, help and apropos, it’s time to investigate how LLDB attaches itself to processes. You’ll learn all the different ways you can attach LLDB to processes using various options, as well as what happens behind the scenes when attaching to processes.

Stopping in Code: Whether you’re using Swift, Objective-C, C++, C, or an entirely different language in your technology stack, you’ll need to learn how to create breakpoints. It’s easy to click on the side panel in Xcode to create a breakpoint using the GUI, but the LLDB console can give you much more control over breakpoints.

Expression: Now that you’ve learned how to set breakpoints so the debugger will stop in your code, it’s time to get useful information out of whatever software you’re debugging. In this chapter you’ll learn about the expression command, which allows you to execute arbitrary code in the debugger.

Thread, Frame & Stepping Around: You’ve learned how to create breakpoints, how to print and modify values, as well as how to execute code while paused in the debugger. But so far you’ve been left high and dry on how to move around in the debugger and inspect data beyond the immediate. In this chapter, you’ll learn how to move the debugger in and out of functions while LLDB is currently paused.

Image: It’s time to explore one of the best tools for finding code of interest through the powers of LLDB. In this chapter, you’ll take a deep dive into the image command.

Watchpoints (New!): Learn an attractive alternative to creating breakpoints by monitoring reads or writes to memory.

Persisting & Customizing Commands: In this chapter, you’ll learn how to persist these choices through the .lldbinit file. By persisting your choices and making convenience commands for yourself, your debugging sessions will run much more smoothly and efficiently. This is also an important concept because from here on out, you’ll use the .lldbinit file on a regular basis.

Regex Commands: In the previous chapter, you learned about the command alias command as well as how to persist commands through the lldbinit file. Unfortunately, command alias has some limitations. The LLDB command command regex acts much like command alias, except you can provide a regular expression for input which will be parsed and applied to the action part of the command.

Section II: Understanding Assembly

Assembly Register Calling Convention: Now you’ve gained a basic understanding of how to maneuver around the debugger, it’s time to take a step down the executable Jenga tower and explore the 1s and 0s that make up your source code. This section will focus on the low-level aspects of debugging.

Assembly & Memory: In this chapter, you’ll explore how a program executes. You’ll look at a special register used to tell the processor where it should read the next instruction from, as well as how different sizes and groupings of memory can produce very different results.

Assembly & the Stack: What does being “passed on the stack” mean exactly? It’s time to take a deeper dive into what happens when a function is called from an assembly standpoint by exploring some “stack related” registers as well as the contents in the stack.

Learn how to reverse engineer code like a boss!

Section III: Low Level

Hello, Ptrace: As alluded to in the introduction to this book, debugging is not entirely about just fixing stuff. Debugging is the process of gaining a better understanding of what’s happening behind the scenes. In this chapter, you’ll explore the foundation of debugging, namely, a system call responsible for a process attaching itself to another process: ptrace.

Dynamic Frameworks: With dynamic frameworks comes a very interesting aspect of learning, debugging, and reverse engineering. Since you have the ability to load the framework at runtime, you can use LLDB to explore and execute code at runtime, which is great for spelunking in both public and private frameworks.

Hooking & Executing Code with dlopen & dlsym: It’s time to learn about the complementary skills of developing with these frameworks. In this chapter, you’re going to learn about methods and strategies to “hook” into Swift and C code as well as execute methods you wouldn’t normally have access to.

Exploring & Method Swizzling Objective-C Frameworks: You’ll cap off this round of dynamic framework exploration by digging into Objective-C frameworks using the Objective-C runtime to hook and execute methods of interest.

Section IV: Custom LLDB Commands

Hello, Mach-O (New!): The file format used for a compiled program running on any Apple hardware. This chapter discusses how to read this information.

Mach-O Fun (New!): Now that you’ve learned the theory, it’s time to have some fun. Learn how to search for curse words in Apple frameworks and cheat at gambling games!

Code Signing (New!): This chapter will give you a basic overview of how code signing works by having you pick apart an iOS application and learn how to re-sign and install it onto your iOS device.

Hello, Script Bridging: Next up in the tradeoff between convenience and complexity is LLDB’s script bridging. With script bridging, you can do nearly anything you like. Script bridging is a Python interface LLDB uses to help extend the debugger to accomplish your wildest debugging dreams.

Debugging Script Bridging: You need a methodical way to figure out what went wrong in your LLDB script so you don’t pull your hair out. In this chapter, you’ll explore how to inspect your LLDB Python scripts using the Python pdb module, which is used for debugging Python scripts.

Script Bridging Classes & Hierarchy: You’ve learned the essentials of working with LLDB’s Python module, as well as how to correct any errors using Python’s PDB debugging module. Now you’ll explore the main players within the lldb Python module for a good overview of the main parts. In this chapter, you’ll add some arguments to this script and deal with some annoying edge cases, such handling commands differently between Objective-C and Swift.

Script Bridging with Options & Arguments: When you’re creating a custom debugging command, you’ll often want to slightly tweak functionality based upon options or arguments supplied to your command. A custom LLDB command that can do a job only one way is a boring one-trick pony. In this chapter, you’ll explore how to pass optional parameters (aka options) as well as arguments (parameters which are expected) to your custom command to alter functionality or logic in your custom LLDB scripts.

Script Bridging with SBValue & Memory: So far, when evaluating JIT code (i.e. Objective-C, Swift, C, etc. code that’s executed through your Python script), you’ve used a small set of APIs to evaluate the code. It’s time to talk about a new class in the lldb Python module, SBValue, and how it can simplify the parsing of JIT code output.

SB Examples, Improved Lookup: For the rest of the chapters in this section, you’ll focus on Python scripts. As alluded to in the previous chapter, the image lookup -rn command is on its way out. When you finish this chapter, you’ll have a new script named “lookup” which queries in a much cleaner way.

SB Examples, Resymbolicating a Stripped ObjC Binary: When LLDB comes up against a stripped executable (an executable devoid of DWARF debugging information), LLDB won’t have the symbol information to give you the stack trace. Instead, LLDB will generate a synthetic name for a method it recognizes as a method, but doesn’t know what to call it. In this chapter, you’ll build an LLDB script that will resymbolicate stripped Objective-C functions in a stack trace.

SB Examples, Malloc Logging: For the final chapter in this section, you’ll go through the same steps I myself took to understand how the MallocStackLogging environment variable is used to get the stack trace when an object is created. From there, you’ll create a custom LLDB command which gives you the stack trace of when an object was allocated or deallocated in memory — even after the stack trace is long gone from the debugger.

Section V: DTrace

Hello, DTrace: You’ll explore a very small section of what DTrace is capable of doing by tracing Objective-C code in already compiled applications. Using DTrace to observe iOS frameworks (like UIKit) can give you an incredible insight into how the authors designed their code.

Intermediate DTrace: This chapter will act as a grab-bag of more DTrace fundamentals, destructive actions (yay!), as well as how to use DTrace with Swift. In this chapter, you’ll learn additional ways DTrace can profile code, as well as how to augment existing code without laying a finger on the actual executable itself.

DTrace vs objc_msgSend: In this chapter, you’ll use DTrace to hook objc_msgSend’s entry probe and pull out the class name along with the Objective-C selector for that class. By the end of this chapter, you’ll have LLDB generating a DTrace script which only generates tracing info for code implemented within the main executable that calls objc_msgSend.

Who Is this Book for?

This book is for intermediate to advanced developers who want to take their debugging and code exploration game to the next level.

The art of debugging code should really be studied by every developer. However, there will be some of you that will get more out of this book. This book is written for:

Developers who want to become better at debugging with LLDB.

Developers who want to build complex debugging commands with LLDB.

Developers who want to take a deeper dive into the internals of Swift and Objective-C.

Developers who are interested in understanding what they can do to their program through reverse engineering.

Developers who are interested in modern, proactive reverse engineering strategies.

Developers who want to be confident in finding answers to questions they have about their computer or software.

Introducing the Author

Derek Selander became interested with debugging when he started exploring how to make (the now somewhat obsolete) Xcode plugins and iOS tweaks on his jailbroken phone, both of which required exploring and augmenting programs with no source available. In his free time, he enjoys pickup soccer, guitar, and playing with his two doggies, Jake & Squid.

Also Available: the iOS 12 Launch Bundle

So many of you have asked for a book bundle to go with the iOS 12 update season, and we’re happy to announce the release of the iOS 12 Launch Party Bundle!

This three-book bundle contains our newest iOS 12 books:

This bundle is on sale for only $99.99 — that’s a savings of 33%! But don’t wait, since this bundle won’t be available forever.

Enter the iOS 12 Launch Party Giveaway

Speaking of sweet deals, be sure to check out the great prizes we’re giving away this year with the iOS 12 Launch Party, including over $9,000 in giveaways!

To be eligible for for this epic iOS 12 giveaway, all you have to do is leave a comment on the original launch post, letting us know which book or course is your favorite on this list — or which upcoming book or course you’re most excited about!

Where to Go From Here?

Here’s how to get your hands on this new release:

If you’ve already bought the digital edition of Advanced Apple Debugging & Reverse Engineering, you can log in to your account and download this update immediately.

If you haven’t yet bought the digital version of Advanced Apple Debugging & Reverse Engineering, you can pick up a copy on the raywenderlich.com store page.

To celebrate the release of the third version of the book, you can get the digital edition of the book for $44.99 for the next few days, so grab it while you can:

The Advanced Apple Debugging & Reverse Engineering team and I hope you enjoy the book — and we can’t wait to hear about your debugging and reverse engineering adventures!